Automated security testing is not new. Vulnerability scanners have existed for decades, running checklists of known CVEs against known service banners and producing reports that security teams have learned, over time, to treat with calibrated scepticism. They are useful. They are also fundamentally limited by the same constraint: they can only find what they were told to look for.

Agentic red teaming is a different category. The distinction is not a marketing one — it is architectural. An automated scanner executes a fixed sequence of checks. An agentic system reasons about what it has found, decides what to do next, adapts when a technique fails, and chains individual weaknesses into exploitable attack paths. That is what a skilled human attacker does. It is not what a scanner does.

The automation versus autonomy distinction

Automation follows a script. Autonomy pursues a goal. A scanner is told: check these 40,000 signatures against these IP ranges. An agentic red team is told: find a path to the domain controller. The agentic system then reasons about which entry points are plausible, which credentials might be reused, which misconfigurations in one system create exposure in another, and whether the path it has started down is still the most promising one.

This matters because real attacks do not look like CVE checklists. The breaches that cause the most damage are typically not the exploitation of a single critical vulnerability. They are chains of individually low-severity findings — a misconfigured cloud storage bucket, a password reused from a previously leaked credential set, an overly permissive service account — that an attacker assembles into a complete path from internet to crown jewels.

89%
Rise in AI-powered cyberattacks year-over-year (CrowdStrike)
82%
Of attacks in 2023 were malware-free, using legitimate tools and living-off-the-land techniques
~1,060
Vulnerability reports filed by XBOW in its first operational period, at a rate exceeding most human teams

What agentic systems can do that scanners cannot

The practical differences show up in three areas. First, context. A scanner checks whether a service is vulnerable to a known exploit. An agentic system checks whether the vulnerable service, combined with the network segmentation policy and the user account permissions it has observed, creates a path that matters. A CVSS 5.4 finding that gives access to a development server is noise. The same finding, when the development server has production database credentials hardcoded in a config file, is critical. A scanner scores the first. An agentic system finds the second.

Second, adaptation. Real penetration testers change approach when a technique is blocked. They try a different authentication bypass when the first is patched. They pivot from web application testing to infrastructure when the application perimeter is solid. Agentic systems do the same — maintaining a model of what they have tried, what has worked, what the environment has revealed about itself, and what to attempt next.

Third, coverage at scale. A human red team of four people cannot continuously test an estate of 60 internet-facing applications. An agentic system can run 26 specialist modules across 6 attack vectors simultaneously, maintaining coverage that a human team cannot sustain.

The 82% gap. CrowdStrike's data shows that 82% of attacks in 2023 used no malware at all — attackers operated using legitimate system tools, stolen credentials, and living-off-the-land techniques. Traditional scanners detect malware signatures. They have no mechanism to detect an attacker who uses only tools that are already authorised on your systems. Agentic red teaming tests these behavioural paths explicitly.

The XBOW benchmark

XBOW is one of the early agentic security systems for which public performance data exists. In its first operational period, it filed approximately 1,060 vulnerability reports — a rate that exceeded the output of most professional human red teams operating over the same period. More importantly, the findings included chained attack paths that required reasoning across multiple systems, not single-system CVE matches.

This is not a case against human red teamers. Human red teamers bring creativity, domain knowledge, and the ability to reason about business context in ways that current agentic systems do not replicate. The case is that agentic systems handle the volume and consistency problem that makes continuous coverage impossible at human scale.

The question is not whether AI will be used in security testing. It is whether you use it first, or your adversary does.

The adversarial adoption curve

The 89% rise in AI-powered attacks documented by CrowdStrike is not a forecast — it is a measurement of what happened last year. Adversaries are already using agentic tooling to identify targets, craft phishing campaigns, discover credentials, and accelerate the lateral movement phase. The breakout time data reflects this: 29 minutes from initial access to lateral movement is a figure that reflects AI assistance on the attacker side.

The asymmetry that matters is not AI versus human. It is AI-assisted attacker versus human-scale defender. Agentic red teaming is the mechanism for closing that asymmetry — putting the same adaptive, continuous, scalable capability on the defensive side of the equation.

Close your security gaps — continuously.

Arxiis runs 26 specialist security modules across 6 attack vectors and 11 compliance frameworks, operating as an autonomous AI red team against your live environment. Every finding is CVSS-scored, MITRE ATT&CK-tagged, and delivered as a board-ready report in hours. Entirely on-premise.